CVE-2024-41810

Deeper analysis

Twisted is an event-based framework for internet applications supporting Python 3.6 and later. The vulnerability resides in the twisted.web.util.redirectTo function, which contains an HTML injection flaw that produces reflected cross-site scripting in the redirect response HTML body when application code permits an attacker to control the redirect URL. It is tracked as CVE-2024-41810 with CVSS 6.1 and is associated with CWE-79 and CWE-80.

An unauthenticated remote attacker can supply a crafted redirect URL to a vulnerable application, resulting in execution of arbitrary script in the context of the victim's browser when the redirect response is rendered. This enables limited impacts such as data leakage or UI manipulation without requiring user authentication or special privileges beyond the ability to influence the URL parameter.

The issue is resolved in Twisted 24.7.0rc1, as detailed in the project's GitHub security advisory GHSA-cf56-g6w6-pqq2 and the corresponding commit that sanitizes the redirect target. Debian has also published an update addressing the flaw in its LTS distribution. The associated EPSS score remains near 0.68 with no material post-disclosure rise from a low baseline.